FBI, grand jury now probing high school’s webcam spying (Updated)

We bet Harriton High School is starting to regret implementing its "security" …

The furor over the Harriton High School webcam spying caper continues to grow. The Federal Bureau of Investigation is now investigating whether the school broke any federal wiretap laws when it remotely spied on a student at home, an anonymous official told the Associated Press. A federal grand jury has also subpoenaed the school for records related to the so-called "security" measures implemented on the laptops that allowed officials to activate the webcams to see people using them, according to the Philadelphia Inquirer.

The Lower Merion School District (LMSD) has also started talking to the press about the incident. Spokesman Doug Young told the AP that the school had activated the webcams on the school-issued laptops 42 times over the last year or so, but never to spy on the students. LMSD had said on Friday—when it decided to indefinitely suspend the practice—that the feature was there solely for security purposes in order to locate lost or stolen laptops.

With more than 2,300 of these laptops issued across the district, it's impractical to assume that every student was in danger of being spied on. However, it's clear that LMSD knows where it ran afoul: by not letting parents know about the feature when having them sign the paperwork for the computers. "There was no specific notification given that described the security feature," Young told the Inquirer. "That notice should have been given, and we regret not giving it. That... was a significant mistake."

A "significant mistake" barely describes the situation now that there's not only a lawsuit, but the FBI is also involved. As of Monday morning, the school's lawyers are being called to court so a judge can decide whether to bar the school from removing data from any of the 2,300 laptops.

The students all have their pet theories on what's really going on, too. On Friday, we quoted one former Harriton High School student (who had originally posted his comments on Digg) who said he and his friends noticed the webcam's green light come on "from time to time," and some students worried that the school's IT admins had been spying on them. Another current student e-mailed Ars to say that the light does turn on occasionally, but only after a reboot —something he assumes to be a "Mac hardware glitch" (one that none of us on staff have ever experienced on our Macs; perhaps it could be a glitch of the software used to remotely access the laptops).

The current student did say, however, that the entire student population has been aware of the school's ability to turn on the webcams for quite some time due to "a widely circulated story that one of our laptops ended up in Pakistan, and they were taking pictures of the current owner." How this information never managed to make it to any of the parents is a mystery, and we are still left wondering what student Blake J. Robbins could have been doing in front of his MacBook to warrant being disciplined for "improper behavior."

Update: Blake Robbins' attorney spoke to NBC Philadelphia (video link) and claims the school "caught" Robbins with two Mike & Ike candies in his hand, which look like pills. The student apparently eats the candies "religiously" and the school overreacted to the image.

There's a lot of new confirmation now that there's a hands-on technical writeup of the spyware and an interview with the spymasters:http://strydehax.blogspot.com/...harrington-high.html. The dtrace output of the OSX agent will probably be of interest to Ars readers.

As long as the students and parents were informed of the security measures, then no big deal. Since that didn't happen in this case, that's the problem. I would have placed a piece of tape over the camera to at least obscure something.

Wow if they get hit with Title III violations, those individuals will serve a long time in prison. But video does not fall under that rule. You have to capture Audio not video.

10 years prison term easy if audio was captured.

"Under the Act, an interception occurs by the “aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.”8 Pursuant to the Act, a wire communication includes “any communication made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable or other connection.”9 Unlike wire communications, federal law protects oral communications only where there is a reasonable expectation of privacy."

"greater frequency. Video surveillance, however, is not within the purview of Title III.124 The legislative history of Title III indicates that Congress intended to prevent only the interception of oral, wire or electronic communications.125"

Hate to sound like a broken record here, but does this accusation have any credit? I only ask because the lawsuit itself does not directly allege that the student was spied on, and no one has been clear about how/when/why/where the picture was taken—or by whom.

Hate to sound like a broken record here, but does this accusation have any credit? I only ask because the lawsuit itself does not directly allege that the student was spied on, and no one has been clear about how/when/why/where the picture was taken—or by whom.

Originally posted by sapphir8:As long as the students and parents were informed of the security measures, then no big deal. Since that didn't happen in this case, that's the problem. I would have placed a piece of tape over the camera to at least obscure something.

If they turn up any web cam images which were taken of any students it is entirely likely someone will end up going to Jail.

If one of those pictures shows a student half dressed (or worse) they will likely end up spending a considerable amount of time in jail.

And in the second scenario it won't make any difference even if they had been informed.

As long as the students and parents were informed of the security measures, then no big deal. Since that didn't happen in this case, that's the problem. I would have placed a piece of tape over the camera to at least obscure something.

Umm, no. If you look at padams link, it's clearly got the symptoms of a BOFH. Manatory monitored laptops. Admin calling police on laptops not reported stolen because he didn't think access was coming from the right IP address. Same guy giving presentations on how to spy on your users. Hopefully they get beat down so hard everyone else thinks long and hard before trying something similar.

Hate to sound like a broken record here, but does this accusation have any credit? I only ask because the lawsuit itself does not directly allege that the student was spied on, and no one has been clear about how/when/why/where the picture was taken—or by whom.

The lawsuit does allege that. Supposedly the father of the student confirmed this with the school. Hence, the lawsuit.

Originally posted by padams:There's a lot of new confirmation now that there's a hands-on technical writeup of the spyware and an interview with the spymasters:http://strydehax.blogspot.com/...harrington-high.html. The dtrace output of the OSX agent will probably be of interest to Ars readers.

That's really very compelling.

Don't have time to dig through all the links to confirm, but if this blog post is accurate, they heads will definitely roll.

Another current student e-mailed Ars to say that the light does turn on occasionally, but only after a reboot —something he assumes to be a "Mac hardware glitch" (one that none of us on staff have ever experienced on our Macs; perhaps it could be a glitch of the software used to remotely access the laptops).

I haven't checked this on my wife's MacBook, but I know on my Dell the webcam light will flash on momentarily during the boot sequence. Presumably at the point where it's being initialized by the OS?

...

If this kind of thing is going to exist, it needs to have some pretty serious controls. And a school policy on a piece of paper doesn't cut if, if the software doesn't actually enforce the controls. I can just about guarantee that whatever procedures are in place, the admins probably needed no more than a few clicks to start viewing someone's web cam.

There should, at a minimum, be some sort of password known only by a school administrator (not IT) to access the system.

Lower Merion has the 5th highest per-capita income[citation needed] and the 12th highest median household income[citation needed] in the country with a population of 50,000 or more....The median income for a household in the township was $86,373 and the median income for a family was $115,694 (these figures had risen to $114,608 and $148,123 respectively as of a 2007 estimate[3]). Men had a median income of $77,692 versus $43,793 for women. The per capita income for the township was $55,526. About 1.9% of families and 4.5% of the population were below the poverty line, including 2.8% of those under age 18 and 5.6% of those age 65 or over.

The school district is in an upper to upper-middle class area. They got money to burn on these kinds of things.

Hate to sound like a broken record here, but does this accusation have any credit? I only ask because the lawsuit itself does not directly allege that the student was spied on, and no one has been clear about how/when/why/where the picture was taken—or by whom.

The lawsuit does allege that. Supposedly the father of the student confirmed this with the school. Hence, the lawsuit.

No, it doesn’t.

Here's the thing: nowhere in the complaint does the plaintiff claim that the picture that started this furor was acquired through illegal means. The complaint describes how the webcams can be activated—and it claims that the webcams have been used inappropriately, though not in this particular instance—and that the parents were never notified of this capability—which is the real meat and potatoes of the complaint. Even paragraphs 23 – 26 (under SUBSTANTATIVE ALLEGATIONS) nowhere do the plaintiffs claim that this particular photo was acquired illegally.

I’ve read it twice now, but I may be missing something. I still haven’t found any articles that point to the actual evidence—or claim—that this one photo was collected via inappropriate means.

Originally posted by sapphir8:As long as the students and parents were informed of the security measures, then no big deal. Since that didn't happen in this case, that's the problem. I would have placed a piece of tape over the camera to at least obscure something.

The FBI is involved because it is their job to make sure that the people understand that only the government and its agencys can spy on its people with impunity. The FBI is also involved to make sure that the software used wasn't better then their own

we are still left wondering what student Blake J. Robbins could have been doing in front of his MacBook to warrant being disciplined for "improper behavior."

I read something over the weekend that stated the student and/or his parents have claimed the picture showed the student with a piece of candy, which the school mistakenly identified as a pill of some sort and accused the student of drug dealing. The item I read was not an original source however, so I can't verify that the student and/or his parents have actually said that. As near as I can tell the school district has not said anything on this topic, as well they should not in regards to any discipline case.

The most interesting development to me is a quote I saw attributed to the school district, which gave the same "42 times" number mentioned in this Ars article, and then explicitly claimed that all 42 instances were related to laptops that were missing and/or stolen. The quote then went on to note that "missing and/or stolen" would include any laptop removed from the school by a student without authorization. It didn't go so far as to actually state that the student in this case took the laptop home without authorization, but the implication seemed pretty clear to me, and fit with comments I've seen to the previous Ars article which claimed the district is saying the student in this case wasn't supposed to have the computer at the time the alleged picture was taken.

If that's true, that the student took the laptop when he wasn't supposed to, and the district has a documented trail of discovering the laptop missing with no idea what happened to it, I strongly suspect there will be no legal repercussions for the district.

I just added an update to the story, but I wanted you guys to see it too. The family's attorney told NBC Philadelphia that the image in question was of Blake eating Mike & Ike candies, which the school apparently thought were pills.

Just a note about complaints in lawsuits in general - because they are the first document filed in a lawsuit and because they come before the "discovery" stage of a case, complaints usually allege only general information. That is because plaintiffs often do not yet have enough information to allege specifics. The US legal system only require that complaints provide a general basis for the suit, so it's not at all surprising that the complaint doesn't give specifics of how this particular image was acquired. The plaintiff's may not even know that at this point.

Lower Merion has the 5th highest per-capita income[citation needed] and the 12th highest median household income[citation needed] in the country with a population of 50,000 or more....The median income for a household in the township was $86,373 and the median income for a family was $115,694 (these figures had risen to $114,608 and $148,123 respectively as of a 2007 estimate[3]). Men had a median income of $77,692 versus $43,793 for women. The per capita income for the township was $55,526. About 1.9% of families and 4.5% of the population were below the poverty line, including 2.8% of those under age 18 and 5.6% of those age 65 or over.

The school district is in an upper to upper-middle class area. They got money to burn on these kinds of things.

To add - Apple gives computers to schools for programs like this for a pretty low cost. The state of Maine (or some decently sized portion of it at least) does the same thing for highschool students.

Originally posted by eJacqui:I just added an update to the story, but I wanted you guys to see it too. The family's attorney told NBC Philadelphia that the image in question was of Blake eating Mike & Ike candies, which the school apparently thought were pills.

The interesting implication of this, is that the software was *not* being used only to track lost or stolen laptops like the school has previously claimed... I get the feeling that their claim of only accessing the cams 42 times is becoming a little more suspect .

Another point. Whats all the commotion about. I read here all the time about people who love to give up their privacy. Their the first to say if your not committing a crime, what are you worried about. The school was just taking it upon themselves in making sure the students were safe in their homes. So for all you anti-privacy advocates i guess their is nothing wrong here with this scenario. The school district was well intentioned. So all you anti-privacy advocates, better hop into you vehicles with your pickets and drive down there and stand up for the schools right to spy on your kids in your home. Besides you can always justify the schools actions by saying that they spy on your kids all day while at school so whats the difference.

Originally posted by Prelator:Just a note about complaints in lawsuits in general - because they are the first document filed in a lawsuit and because they come before the "discovery" stage of a case, complaints usually allege only general information. That is because plaintiffs often do not yet have enough information to allege specifics. The US legal system only require that complaints provide a general basis for the suit, so it's not at all surprising that the complaint doesn't give specifics of how this particular image was acquired. The plaintiff's may not even know that at this point.

Originally posted by sapphir8:As long as the students and parents were informed of the security measures, then no big deal. Since that didn't happen in this case, that's the problem. I would have placed a piece of tape over the camera to at least obscure something.

That does nothing to combat the use of the microphone, nor does it fix the larger issue. That, being, according to padams' link that these spyware-riddled laptops were mandatory for classes. Likewise, under the vague description of "jailbreaking the laptop," placing any obfuscation of the camera may be seen as an attempt to derail the security system and lead to expulsion.

No. Remote administration is one thing, but end user trust is another. This one took the whole "remote administration" line and completely, utterly, drove well beyond it. There are no excuses for this behaviour.

Originally posted by eJacqui:I just added an update to the story, but I wanted you guys to see it too. The family's attorney told NBC Philadelphia that the image in question was of Blake eating Mike & Ike candies, which the school apparently thought were pills.

The interesting implication of this, is that the software was *not* being used only to track lost or stolen laptops like the school has previously claimed... I get the feeling that their claim of only accessing the cams 42 times is becoming a little more suspect .

Thank you voice of reason. Privacy concerns and illegalities aside, the school district was using the software for purposes other than laptop theft recovery. I think I would've taken the HDD out of my machine, rebuilt it with a retail boxed copy of the OS, and then replaced the HDD once the school year was over. Never, ever, ever, ever, ever trust government or company issued hardware when it comes to privacy. Assume they log everything you do on your computer.

i remember staring at the TV with my jaw agape as the stations began running the story. i said to myself 'how could these people, with that much public responsibility, be so delusional to think that would've ended in anything other than complete and utter disaster'?

i still have trouble discussing this story with friends and co-workers, lol.

Originally posted by eJacqui:I just added an update to the story, but I wanted you guys to see it too. The family's attorney told NBC Philadelphia that the image in question was of Blake eating Mike & Ike candies, which the school apparently thought were pills.

The interesting implication of this, is that the software was *not* being used only to track lost or stolen laptops like the school has previously claimed... I get the feeling that their claim of only accessing the cams 42 times is becoming a little more suspect .

Not what it means at all.

If the laptop was not supposed to have been outside of the bounds of the school at the time, and it was missing (earlier posters allege this, so I'm going with that for this counterpoint) then the school system may have activated the camera to identify the user of the laptop when it came on. If the student (who was authorized to use the laptop, but not have the laptop out at the time) was then doing something either a) illegal b) immoral c) improper and in violation of the TOS, the school system would be within it's rights to do something about that. In this case, allegedly, the student was (mis?)identified as doing something illegal, and the school system took disciplinary action. I'm making no comments as to the merits at various levels to some of these statements being thrown around, just that based on putting together the information in this way, there is no discrepancy between the "only to locate lost or stolen laptops" number and this instance.

As for the webcam turning on briefly during startup that some have talked about, my wife's Toshiba does it, and one of the two webcams that I keep for my laptop does it (but not both) during the initialization process for the webcam (my HP Webcam does, my Logitech does not; both are USB based, and on the same laptop). Not uncommon at all, as near as I can tell, it's just a function of which drivers are used and how they're written.

I wonder if the district admins will continue on with their monumental stupidity and try to modify or remove software from the laptops/server that they have distributed now that this is all blowing up.

Based on that NBC report they could find themselves in a ton of hot water, all the way from the System Admins responsible for installing the software all the way up the chain of command.

It's one thing to think a sysadmin might have abused their power a grabbed a few webcam images; but it's another to have the administration act on those images. This means they were fully aware and supported webcam imaging of the students.